Was the PHP RCE vulnerability as serious as the hype suggested?

karmawarrior writes: Last week's panic about bugs in PHP resulted in numerous website outages and a lot of stress for the development, system administration, and infosec people. But... to date, no real proof of concepts appear to have been released. As Elias Taylor reports, discussing the three most starred PHP RCE proofs of concept on Github:

One really amusing thing in common with most of these "PoC"s is that they lean on "LFI", or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability. It's not rare for PHP apps to be (broken) in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

Taylor suggest the issue is people outsourcing their judgement to Claude et al, with Claude finding the problem, telling the users (correctly) that technically it's an RCE issue, and the users failing to recognize judge the context. It certainly wasn't helped that a PHP core team member appears to have been one of the people who took the reports at face value, stating "exploits will start appearing 15 minutes after the patch drops." And, of course, PHP has a poor reputation for security, albeit largely over design issues than interpreter quality.